Incremental data flow path extraction method based on pointer analysis

Abstract

The invention relates to a pointer analysis-based incremental data flow path extraction method. The method comprises the following steps of: firstly, acquiring an initial pointer variable related to an incremental code as a task variable set; then, performing reverse query on the task variables based on the pointing relation constraint graph to obtain a basic variable set and a memory object pointed by the basic variable set; and after the working set is initialized, executing pointing relation propagation, propagating the memory object to a pointing set of the task variable, and classifying a new association pointer found in propagation into an indirect variable set. And executing explicit dependency query on the indirect variable set, adding a new dependency variable into the task set, repeating the process until the constraint graph is stable, and finally obtaining pointing information of all variables. And an inter-process data dependence sub-graph is constructed, and an incremental data flow path is extracted. According to the method, through a locality principle and a reverse query strategy, an analysis range is limited to incremental code related variables, and the overhead and memory problems of global analysis are avoided.

Description

Technical Field

[0001] This invention relates to the field of software defect detection, specifically to an incremental data flow path extraction method based on pointer analysis. Background Technology

[0002] Software defect detection is a crucial step in ensuring software quality and security. Fuzzing, as a highly efficient automated testing method, is widely used to uncover unknown vulnerabilities in software. Coverage-guided greybox fuzzing (CGF) monitors the coverage of program paths by test cases and dynamically adjusts test inputs to enhance the ability to explore the program's state. Building on this, directed greybox fuzzing (DGF) further focuses the testing objectives on predetermined critical locations in the program (such as patch code, vulnerability recurrence points, etc.), thereby improving the targeting and efficiency of the testing.

[0003] Existing Directed Geometric Fibre (DGF) methods largely rely on control flow coverage (such as edge coverage) as a feedback mechanism. While simple to implement, these methods have limited ability to characterize program states, particularly failing to capture potential defects arising from data dependencies. To address this, researchers have proposed using data flow path coverage as a supplementary feedback mechanism to enhance the ability to uncover hidden vulnerabilities in programs. However, data flow path extraction relies on pointer analysis techniques. Especially when dealing with large software systems (such as compilers and operating systems), traditional pointer analysis algorithms (such as Andersen's algorithm) face serious scalability issues: their full-program analysis strategy leads to huge memory consumption, excessively long analysis times, and even inability to complete analysis with limited resources, thus restricting the application of data flow-guided fuzzing in real-world projects.

[0004] Therefore, there is an urgent need for a pointer analysis method that can maintain high accuracy and has good scalability to support the efficient extraction of data flow paths in incremental code in large software, thereby promoting the application of guided gray-box fuzzing in industrial projects. Summary of the Invention

[0005] This invention provides an incremental data flow path extraction method based on pointer analysis, which aims to solve the problem that existing pointer analysis algorithms cannot efficiently and scalably extract data flow paths related to incremental code on large software due to excessive computational overhead.

[0006] To achieve the above objectives, this invention provides an incremental data flow path extraction method based on pointer analysis, comprising the following steps: Obtain the initial set of pointer variables associated with the incremental code as the task variable set; Based on the pointer relationship constraint graph, a reverse lookup is performed on the variables in the task variable set to obtain the base variable set and the set of memory objects pointed to by the base variable set; The working set is initialized with the base variable set and the memory object set. The pointer relationship propagation process is executed to propagate the objects in the memory object set to the pointer set of the variables in the task variable set. Pointer variables that point to the memory objects and do not belong to the task variable set are found during the propagation process and are included in the indirect association variable set. Perform explicit dependency variable query on the variables in the indirect association variable set, add the dependency variables obtained by the query to the task variable set, and repeat the reverse query and pointing relationship propagation process until the pointing relationship constraint graph no longer changes. At this time, the final pointing information of all variables in the task variable set and the indirect association variable set is obtained. Based on the obtained final pointing information, an inter-process data dependency subgraph corresponding to the incremental code is constructed, and then the incremental data flow path is extracted.

[0007] Furthermore, methods for obtaining the initial set of pointer variables associated with the incremental code as a task variable set include: Traverse the instruction sequence within the basic block containing the incremental code; Obtain the pointer variables used or defined in the instruction sequence and form the first variable set; Based on the pre-established explicit data dependency mapping relationship between variables, explicit dependency variable lookup is performed on the variables in the first variable set to obtain the set of pointer variables that they directly depend on, which serves as the second variable set. The first set of variables and the second set of variables are merged to obtain the task variable set.

[0008] Furthermore, methods for performing reverse lookups include: Starting from the variables in the task variable set, a recursive query is performed along the incoming edge of the pointing relationship on the pointing relationship constraint graph; During the recursion, if a pointer variable with a basic constraint edge of address allocation class is encountered, it is taken as the recursion endpoint and added to the basic variable set; The recursive query continues until all the base variable sets that can pass pointers to objects to the task variable set are found; The address allocation class basic constraint edge corresponds to the Alloca instruction in LLVM. The pointer variable returned by the Alloca instruction has a basic pointing relationship, and the object it points to is the memory object allocated by the Alloca instruction.

[0009] Furthermore, methods for performing the pointer-to-relation propagation process include: A working set is initialized with the set of base variables and the set of memory objects they point to; Retrieve pointer variables from the working set, process their copy outgoing edges, load outgoing edges, and store outgoing edges, and propagate objects in the memory object set to the variable set pointed to by the pointer variable; During the propagation process, if it is found that a memory object is propagated to the set of pointer variables that does not belong to the task variable set, then the pointer variable is added to the indirect association variable set. The methods for handling and storing outgoing edges include: For each outgoing edge of the current pointer variable, obtain the target node of that outgoing edge. Propagate the memory objects in the current pointer variable's pointer set to the pointer set of the target node; If the target node does not belong to the task variable set, then add it to the indirect association variable set.

[0010] Furthermore, the propagation process is executed iteratively, continuously processing the variables in the working set until the working set is empty and the pointer constraint graph no longer changes, indicating that the propagation process has reached a fixed point.

[0011] Furthermore, the method for performing explicit dependency variable lookup on variables in the indirect association variable set includes: Iterate through each pointer variable in the set of indirectly related variables; For each pointer variable, based on the pre-established explicit variable data dependency mapping, query all other pointer variables that it directly depends on; Add all directly dependent pointer variables found in the query to the task variable set.

[0012] Furthermore, the method of repeatedly executing the reverse query and pointer relationship propagation process until the pointer relationship constraint graph no longer changes includes: Whenever a new variable is added to the task variable set, the reverse query is re-executed based on the updated task variable set to obtain a new base variable set and memory object set, and the working set is re-initialized to execute the pointer relation propagation process; This iterative process continues until, in a complete iteration, the task variable set, the indirect association variable set, and the pointing relationship constraint graph no longer change, at which point the final pointing information of all relevant variables is obtained.

[0013] Furthermore, methods for constructing inter-process data dependency subgraphs include: Based on the final pointer information, identify all instruction pairs that have data dependencies on incremental code instructions; Extract the Def-Use edges formed by the instruction pairs, including explicit dependency edges and implicit dependency edges; All Def-Use edges are combined to form the inter-process data dependency subgraph.

[0014] Furthermore, the incremental data flow path consists of instructions within the incremental code basic block, as well as all instructions that have direct or indirect data dependencies with these instructions.

[0015] Furthermore, if the method detects that a new pointer variable has been added to the indirect association variable set during the propagation of the pointer relationship, it triggers an explicit dependency variable query for that variable and adds the query result to the task variable set, thereby triggering a new round of reverse query and propagation process.

[0016] The beneficial effects of this invention are: Compared with existing technologies, this invention provides an incremental data flow path extraction method based on pointer analysis, which efficiently solves the aforementioned technical problems by focusing on the incremental code context and using a dynamically iterative pointer analysis framework. Its core lies in abandoning the traditional full-program pointer analysis paradigm and instead precisely locating the initial set of pointer variables (task variable set) related to the incremental code data flow. Based on this, a targeted reverse query is performed on the pointer relationship constraint graph to quickly locate the set of base variables that truly affect the pointer relationships of these variables, thus confining the massive pointer analysis problem to an extremely limited subgraph. Subsequently, through a working set-driven pointer relationship propagation process, the algorithm only performs iterative calculation and propagation of pointer information within this subgraph, and dynamically identifies indirect variables that, although not belonging to the initial task set, are related to the target memory object, including them in the analysis scope for iterative solution. This "point-to-surface, dynamically expanding" analysis strategy ensures that the algorithm does not need to handle all irrelevant pointer constraints in the entire program, greatly reducing computational and memory overhead. Furthermore, due to the inheritance of the inclusion-based pointer analysis paradigm, its accuracy is guaranteed, ultimately achieving efficient and scalable extraction of accurate incremental data flow paths on large-scale software. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0018] Figure 1 This is a flowchart of an incremental data flow path extraction method based on pointer analysis disclosed in an embodiment of the present invention.

[0019] Figure 2 This is a schematic diagram illustrating the proof process of a TAN pointer analysis algorithm disclosed in an embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] According to embodiments of the present invention, it should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the following manufacturing method, in some cases the steps shown or described may be performed in a different order than that shown here.

[0022] This invention designs a pointer analysis algorithm, named TAN pointer analysis algorithm, to support incremental data flow path extraction in guided fuzzing. The TAN pointer analysis algorithm belongs to the inclusion-based pointer analysis paradigm. This paradigm uses subset relations as constraints between pointer variables, resulting in higher analysis accuracy compared to union-based pointer analysis. The design goal of the TAN pointer analysis algorithm is to maintain the accuracy achievable by the Andersen algorithm while avoiding analysis of all pointer variables in the entire program, thus improving the scalability of the pointer analysis algorithm in incremental path extraction scenarios.

[0023] like Figure 1 As shown, this invention provides an incremental data flow path extraction method based on pointer analysis, comprising the following steps: Step S100: Obtain the initial set of pointer variables associated with the incremental code as the task variable set; Step S200: Based on the pointing relationship constraint graph, perform a reverse query on the variables in the task variable set to obtain the base variable set and the set of memory objects pointed to by the base variable set; Step S300: Initialize the working set with the base variable set and the memory object set, execute the pointer relationship propagation process, propagate the objects in the memory object set to the pointer set of the variables in the task variable set, and classify the pointer variables that point to the memory objects and do not belong to the task variable set found in the propagation process into the indirect association variable set; Step S400: Perform explicit dependency variable query on the variables in the indirect association variable set, add the dependency variables obtained by the query to the task variable set, and repeat the reverse query and pointing relationship propagation process until the pointing relationship constraint graph no longer changes. At this time, the final pointing information of all variables in the task variable set and the indirect association variable set is obtained. Step S500: Based on the obtained final pointing information, construct the inter-process data dependency subgraph corresponding to the incremental code, and then extract the incremental data flow path.

[0024] In this embodiment, as described in step S100 above, this step precisely defines and obtains the initial batch of pointer variables closely related to the target incremental code data flow, constituting the initial target set for subsequent pointer analysis tasks. This step effectively limits the analysis scope by focusing on the incremental code itself and its direct explicit data dependencies, avoiding unnecessary analysis of all pointer variables in the entire program as in traditional methods, thus fundamentally reducing computational overhead. The specific implementation process includes the following sub-steps: First, the algorithm iterates through all LLVM intermediate representation (LLVM IR) instruction sequences within the basic block containing the incremental code (denoted as IncreIns = {I1, I2, I3, ..., I...). n LLVM IR is a low-level program representation that is independent of the source language and target machine architecture. It features strong typing and adherence to a single static assignment paradigm, making it suitable for program analysis. In LLVM IR, variables can be divided into explicit and implicit variables. Explicit variables are those that are not addressed to (i.e., do not use the & operator). They are directly defined and used by instructions, conforming to the single static assignment paradigm, and their dependencies can be directly determined through instruction operands. Implicit variables, on the other hand, are memory objects whose addresses are taken and may be accessed indirectly through pointers. They do not follow the single static assignment paradigm, and their reading and writing must be done through explicit variables using the store and load instructions. Next, the algorithm analyzes each instruction in the instruction sequence, identifying and collecting all explicit variables defined or used within the basic block. Explicit variables of pointer type are extracted and form the first variable set. These pointer variables directly participate in memory access operations within the incremental code (e.g., as operands of load or store instructions).

[0025] However, capturing direct dependencies is insufficient for constructing a more complete view of the data flow. By definition, data dependencies between instructions include not only the dependency of return values ​​on parameters but also the dependency between parameters themselves. Therefore, the algorithm needs to further capture other pointer variables that have explicit data dependencies on the variables in the first variable set. This is accomplished by querying two global explicit data dependency mapping tables that were constructed during the preprocessing stage: IDependsWhoMap: This mapping records which other explicit variables a given explicit variable directly depends on (i.e., querying its direct upstream dependencies).

[0026] WhoDependsIMap: This map records which other explicit variables directly depend on a given explicit variable (i.e., query its direct downstream dependencies).

[0027] By querying IDependsWhoMap, we can find all other pointer variables that each pointer variable in the top-level incremental memory variable directly depends on; by querying WhoDependsIMap, we can find all other pointer variables that directly depend on each pointer variable in the top-level incremental memory variable. These retrieved variables together form the second variable set.

[0028] Finally, the algorithm merges the first and second variable sets to form the initial task variable set. This set precisely encompasses all pointer variables that have direct memory operation relationships with the incremental code and first-level explicit data dependencies, defining a precise initial scope for efficient, goal-oriented pointer analysis on the constraint graph, thus avoiding the huge overhead of full-program analysis.

[0029] Understandably, by analyzing newly added or modified code (incremental code), the first step is to identify all pointer variables directly used and defined by this code (the first set of variables). Then, like searching a network of relationships, based on a pre-established dependency mapping between variables, other pointer variables that have direct dependencies on the variables in the first set are found (the second set of variables). Finally, these two sets of variables are merged to form a final, clearly defined list of variables to be analyzed (the initial task variable set). This avoids the time-consuming and labor-intensive comprehensive analysis of all pointers in the entire program, instead concentrating computational resources on variables truly relevant to the incremental code, thereby greatly improving the efficiency of subsequent analysis.

[0030] In this embodiment, as described in step S200 above, the purpose is to establish an accurate and minimized initial working set for the subsequent pointer relationship propagation process, thereby greatly reducing the computational complexity of the entire pointer analysis. Unlike traditional full-program pointer analysis (such as the Andersen algorithm), which starts from all allocation nodes and performs a "forward" propagation potentially covering the entire program, this step starts from the task variable set determined in step S100 (i.e., the initial task variable set and the variables expanded in subsequent iterations), and performs a "reverse" tracing on the pointer relationship constraint graph to accurately identify the most original pointer variables (i.e., the base variable set) and the sets of memory objects they point to that truly provide the target objects for the task variable set.

[0031] A pointer constraint graph is a graphical model used to represent the "pointing" constraint relationship between pointers. The edges in the graph constrain the subset relationship of the pointer sets between nodes (variables or objects), and it is the basic data structure for performing subset-based pointer analysis.

[0032] Reverse lookup is an analysis strategy that traces back from the variables in the task variable set. It only tracks the constraint paths related to the target and avoids dealing with irrelevant parts of the overall program constraint graph.

[0033] Specifically, the execution process of this step is as follows: For each pointer variable in the task variable set, the algorithm recursively queries the pointer relationship constraint graph starting from that node and moving in the opposite direction of the constraint edge (i.e., along the "incoming edge").

[0034] The logic of the recursive process is: in order to know what a variable points to, we need to know which nodes' targets will be propagated to it through constraint edges.

[0035] The algorithm behaves differently when handling different types of incoming edges: When an Address-Of edge (basic constraint edge, corresponding to the Alloca instruction in LLVM) is encountered, it means that the query has reached a recursive endpoint. The destination node of this edge is a pointer variable, and its source node is a memory object. The algorithm adds this pointer variable to the base variable set. When a Copy In edge is encountered, it means that the target pointed to by the current node may come from another pointer variable, and the algorithm will continue to recursively query the node. When a Load In edge is encountered, it means that the target of the current node comes from the pointer set of a memory object. The algorithm will further search for the relevant Store edge and recursively search for the source node. The logic is similar when handling GetElementPtr In edges; the algorithm will continue to recursively query the source node of the edge.

[0036] Through the recursive reverse lookup process described above, the algorithm ultimately obtains two key results: first, a set of base variables, which are the source pointer variables that directly point to newly allocated memory objects through basic constraint edges; and second, a set of memory objects, which is the collection of abstract objects in memory pointed to by the base variable set, and is the target that ultimately needs to be propagated to the variable pointer set in the task variable set. The base variable set consists of variables generated by the Alloca instruction in the program, directly pointing to the newly allocated memory region, and serves as the "seed" for propagating pointer relationships. In LLVM IR, the set of memory objects corresponds to an abstract representation of the stack space allocated by the Alloca instruction or the heap space allocated by functions such as malloc.

[0037] In summary, step S200, through the reverse lookup mechanism, successfully focused its massive pointer analysis task on a minimal constraint subgraph that is truly relevant to the incremental code, laying a solid foundation for the next step of efficient and accurate pointer relationship propagation.

[0038] In this embodiment, as described in step S300 above, the purpose is to accurately propagate the set of memory objects obtained by reverse lookup in step S200 to the set of pointers of all pointer variables in the task variable set, and in this process identify all pointer variables that are related to this propagation chain but are not covered by the task variable set.

[0039] This step begins with an initialized working set, which contains the set of basic variables found in step S200 and their pointer set. Its core is to use an iterative, working set-based algorithm to simulate the transitive closure calculation process of pointer pointing relationships on the constraint graph. However, unlike the full program analysis, this process is limited to the subgraph related to the incremental code data flow, thus ensuring efficiency.

[0040] During the iteration process, the algorithm continuously retrieves a pointer variable node from the working set and processes its three types of outgoing constraint edges to propagate the target (i.e., the memory object) to the downstream node.

[0041] Handling outgoing edges by copying is relatively straightforward. The algorithm will propagate the pointer set of the current node to the pointer set of the target node of the edge. If the pointer set of the target node is updated as a result, it will be added to the working set for subsequent propagation.

[0042] Handling load-out edges involves a layer of indirect access. This edge usually originates from a Load instruction (such as P = loadQ), indicating that the pointer set of P should contain elements in the pointer set (i.e., pts(o)) of the memory object pointed to by Q (denoted as o, o ∈ pts(Q)). When the TAN algorithm processes this edge, it traverses each memory object o in pts(Q) and adds the pointer set of the current node to the pointer set of o. If the pointer set of o changes, the storage edge node related to o will be added to the working set. This reflects the indirect update of memory objects.

[0043] The most crucial difference from the classic Andersen algorithm lies in the handling of outgoing edges, which originate from a Store instruction (such as store P, Q). In traditional algorithms, the usual approach is to store incoming edges, i.e., update the pointer set of the object pointed to by P from the perspective of Q, but this requires Q to be in the working set.

[0044] To adapt to its focused analysis nature, the TAN pointer analysis algorithm proactively handles store-out edges: starting from the current node P (the source operand of the Store instruction), it finds all its Store Out edges. For each edge, the algorithm obtains its target node (i.e., the destination operand pointer of the Store instruction, denoted as StoreDst), and then propagates the pointer set (pts(P)) of the current node P to the pointer set (pts(o)) of every memory object o (o ∈ pts(StoreDst)) pointed to by StoreDst. If pts(o) is updated as a result, the node associated with o is added to the working set. This approach ensures that even if StoreDst is not in the initial task variable set, its associated storage side effects can be correctly captured.

[0045] During the propagation process, whenever a memory object is successfully propagated to the set of pointer variables, and that pointer variable is not in the current task variable set, it is identified and added to the indirect association variable set. The indirect association variable set records all pointer variables that, although not within the scope of the current analysis target, have their pointer sets affected by the set of memory objects. These variables are the key bridges connecting the incremental code with the data flow of other parts of the program. The entire iterative process continues until the working set is empty and the pointer relationship constraint graph no longer changes, meaning the algorithm has reached a fixed point, indicating that all possible pointer relationships have been propagated. Through step S300, the TAN pointer analysis algorithm not only calculates the accurate pointer information of variables in the task variable set but also efficiently discovers all indirectly related variables.

[0046] In this embodiment, as described in step S400 above, the set of indirectly related variables discovered during the propagation of pointer relationships in step S300 is processed, and iterative analysis is used to ensure that all pointer variables that have potential associations with the incremental code data stream are included in the analysis scope, thereby finally obtaining a complete and consistent pointer information solution.

[0047] The indirect association variable set refers to those pointer variables whose pointer set is found to contain the target memory object during the propagation of pointer relations, but which are not in the task variable set themselves. Their appearance means that the data flow of incremental code may depend on some existing code components in the program, so the constraint relationships involved in these variables must also be included in the analysis.

[0048] This step begins by performing an explicit dependency query based on a sequence of instructions for each pointer variable in the indirectly related variable set. This process is consistent with the query logic in step S100: that is, by querying the pre-established explicit data dependency mapping, all other pointer variables that the indirectly related variable set directly depends on are identified. These newly discovered dependency variables reveal the "upstream" source of the indirectly related variable set in the data flow, and they are added to the task variable set, thereby expanding the core objective scope of pointer analysis.

[0049] Subsequently, the algorithm uses the updated task variable set as new input and re-executes step S200's constraint graph-based reverse lookup and step S300's pointer propagation process. Through iterative loops: the new task variable set guides the reverse lookup to find new base variable sets and memory objects; the new propagation process expands the pointer relationships to a wider range and may discover new indirectly related variables and add them to the indirectly related variable set. This loop continues until, in a certain iteration, both the task variable set and the indirectly related variable set no longer change, and the pointer constraint graph remains stable. At this point, the algorithm reaches a fixed point, meaning that all relevant pointer relationships have been calculated and no new information can be derived.

[0050] Through multiple iterations of step S400, the TAN pointer analysis algorithm successfully expands the scope of pointer analysis, which was initially limited to incremental code, to all code regions in the entire program that have data flow associations with it in a progressively expanding, goal-driven manner. Thus, without having to perform full program analysis, it obtains the same precision of final pointer information as full program pointer analysis (on the subgraph it is interested in).

[0051] In this embodiment, as described in step S500 above, the final pointing information calculated in the preceding steps (S100 to S400) is used to construct an inter-process data dependency subgraph that precisely corresponds to the incremental code, and the incremental data flow path is extracted from it.

[0052] Specifically: First, based on the obtained complete pointer information, all instruction pairs with direct or indirect data dependencies on instructions within the incremental code's basic block are identified. These dependencies are represented by Def-Use edges, where explicit dependencies are directly formed by Def-Use relationships on LLVM IR explicit variables, while implicit dependencies are established using pointer results calculated by the TAN pointer analysis algorithm, reflecting indirect data associations formed through read and write operations on implicit variables. Subsequently, the algorithm extracts all these Def-Use edges and combines them into a coherent, inter-process data dependency subgraph, which accurately depicts the data interaction network between the incremental code and other parts of the program. Finally, the incremental data flow path is defined as the set of all data dependency chains in this subgraph that start or end with instructions within the basic block, fully revealing the context and potential impact of the newly introduced code within the overall program data flow.

[0053] The extraction method of this invention specifically extracts the following: by traversing the instruction sequence within the basic block where the incremental code is located, all LLVM instruction pairs that have direct or indirect data dependencies with the code segment are identified, including explicit dependencies (def-use edges based on explicit variables) and implicit dependencies (def-use edges based on implicit variables). A precise inter-process data dependency subgraph is then constructed, which covers all data flow paths originating from the incremental code, including its directly and indirectly dependent instruction nodes and the dependencies between them. Finally, fine-grained coverage feedback information that can be used for guided fuzz testing is formed.

[0054] The main improvement of this invention in the extraction process lies in its efficient extraction of incremental data flow paths through the TAN pointer analysis algorithm. Compared with traditional technical solutions (such as full-program Andersen pointer analysis), the difference is that traditional methods require global analysis of all pointer variables in the entire program, resulting in extremely high computational overhead and difficulty in scaling to large software systems. In contrast, the TAN pointer analysis algorithm, through dynamic iterative expansion of the task variable set and the indirect association variable set, analyzes only pointer variables related to incremental code, significantly reducing the number of constraints in the constraint system. Furthermore, the TAN pointer analysis algorithm introduces a constraint graph-based reverse lookup mechanism, tracing back from the target variable to its underlying constraint variables (such as variables generated by the Alloca instruction), thereby avoiding unnecessary global propagation and further reducing algorithm complexity. During the propagation of pointer relationships, the TAN pointer analysis algorithm also optimizes the handling of Store edges, ensuring correct propagation of pointer relationships even in local working sets by processing Store Out edges instead of Store In edges, thus avoiding omissions. These improvements lie in the fact that the TAN pointer analysis algorithm, through the principle of locality and the reverse lookup strategy, limits the scope of pointer analysis to the set of variables related to the incremental code data flow, avoiding redundant calculations and memory explosion problems in global analysis, thereby achieving efficient and scalable incremental data flow path extraction.

[0055] The TAN pointer parsing algorithm is a working set-based iterative algorithm. The termination capability of the iterative algorithm is related to the usability of the TAN pointer parsing algorithm. The termination capability of the TAN pointer parsing algorithm will be proven below.

[0056] Proof: The TAN pointer parsing algorithm analyzes the objects pointed to by pointers based on the LLVM IR instruction sequence and the pointer constraint graph of the software being analyzed. The core of the algorithm is to iteratively update the constraint graph until it stops changing. The number of LLVM IR instructions, variables, and memory objects in the software being analyzed is finite. Therefore, the number of nodes and edges in the pointer constraint graph is also finite. The TAN pointer parsing algorithm analyzes a finite graph. In each iteration, the TAN pointer parsing algorithm analyzes by adding edges to the constraint graph. Since the number of nodes and edges in the constraint graph is finite, and only a finite number of edges are updated in each iteration, the changes in the graph gradually decrease as the iterations progress. Within a finite number of iterations, the constraint graph will no longer change, and the algorithm terminates.

[0057] Based on the above analysis, we can conclude that the TAN pointer analysis algorithm will inevitably terminate after a finite number of iterations within a finite input and a finite state space.

[0058] Compared to the Andersen algorithm, the reliability of the TAN pointer analysis algorithm in constructing a reliable data dependency subgraph directly impacts the reliability of extracting incremental data flow paths. This embodiment uses mathematical induction to prove the reliability of the TAN pointer analysis algorithm's results by taking an upward query of the nodes dependent on the incremental code as an example. The principle is the same for downward queries of nodes dependent on the incremental code, but in the opposite direction. Figure 2 This is a diagram illustrating the proof process.

[0059] Proof: First, for a node in a basic block, denoted as a level 0 dependency node N0, when a node of this level has a direct data dependency, the TAN pointer analysis algorithm finds all level 1 dependency nodes N1 that the node directly depends on. Figure 2 For example, node 10 is a level 0 node in the basic block. Establishing explicit dependency edges in the data dependency subgraph can be directly achieved using the single static assignment paradigm for explicit variables, without relying on the results of pointer analysis; therefore, edge G exists. The TAN pointer analysis algorithm extracts the pointer variable T used in node 10. 11 After entering the task variable set and calculating the object o1 it points to, it will propagate to T. 10 Therefore, edge H exists.

[0060] Next, we prove that when a k-th level dependency node is included in a data dependency subgraph, a (k+1)-th level dependency node can also be included in the data dependency subgraph. Figure 2 For example, node 3 is already included in the data dependency subgraph. Node 3 also has data dependent nodes, namely nodes 1 and 2 at level k+1. Edge A is an explicit dependency edge and does not depend on the pointer analysis result. The key to the reliability of the data dependency subgraph lies in whether edge B can be established after the TAN pointer analysis algorithm.

[0061] Since node 3 is already in the data dependency subgraph, at least one of the C or D edges must exist in the subgraph. When edge D exists, node 3 has both implicit input and implicit output edges, a situation only satisfied by the Store instruction. At this point, the implicit variable corresponding to node 5 must be the same as those used in nodes 3 and 2. Since edge D already exists, it means o2 has been propagated to T3 and T5. Based on the openness of the transitive closure process, o2 must also have been propagated to T2. At this point, o2∈(pts(T2)∩pts(T3)), and edge B will be constructed. When edge C exists, node 4 is already included in the data dependency subgraph. According to the instruction corresponding to node 3, T4 explicitly depends on variable T3. If T4 appears in the result of an explicit dependency recursive query starting from the basic block, then that explicit dependency query result must also contain T3. The pointer analysis phase will calculate the pointer object pts(T3) = {o j The propagation phase will point to o.j Propagating to pts(T2), edge B exists at this point. If T4 does not appear in the recursive explicit dependency query results starting from the basic block, then traversing down from node 4 along the Def-Use edge until the basic block will encounter at least one implicit dependency edge. When traversing down to the first implicit data edge, the existence of edge B can be deduced based on the source and destination nodes of that edge.

[0062] Let's take edge F as an example to introduce this implicit dependency edge. Edge F is formed by the Def-Use of o3, at which point pts(T6)∩pts(T8) = {o3}. The pointer set of T6 is not empty, indicating that it belongs to either the task variable set or the indirect association variable set. According to the TAN pointer analysis algorithm, regardless of whether T6 belongs to the task variable set or the indirect association variable set, the pointer set of T6's explicit dependencies will definitely be calculated. Searching upwards from T6 up to node 3 reveals explicit dependency edges; recursively searching for explicit dependencies starting from T6 will always lead to T1. For example, T6 explicitly depends on variable T4, and T4 explicitly depends on T1; therefore, the pointer sets of T4 and T1 will definitely be calculated. Therefore, edge B exists.

[0063] Based on the above analysis, when a level 0 node (node ​​3) exists in the data dependency subgraph, all its data dependency edges (edges A and B) will be constructed. More generally, when a level k node exists in the data dependency subgraph, its data-dependent level k+1 nodes will also exist in the data dependency subgraph. In summary, the TAN pointer analysis algorithm supports the construction of reliable data dependency subgraphs.

[0064] The TAN pointer parsing algorithm aims to solve the efficiency problem of the Andersen pointer parsing algorithm when applied to data flow path extraction tasks in guided fuzzing.

[0065] Taking SpiderMonkey, a mainstream industrial-grade JavaScript engine (with over 830,000 lines of source code), as an example, under the condition of a given commit updating code lines, the efficiency of the TAN pointer analysis algorithm in extracting the data flow path associated with a specified code line was tested, and the results are shown in Table 1.

[0066] Table 1: Efficiency Analysis of TAN Pointer Analysis Algorithm

[0067] The TAN pointer parsing algorithm demonstrated the best analysis efficiency across 10 commits, with a maximum analysis time of 14 minutes. In stark contrast, neither the Andersen-based nor the Steinsgaard-based pointer parsing algorithms could complete the analysis within 72 hours. Furthermore, the experimental platform with 256 Gb of memory could not meet the analysis requirements of the Andersen and Steinsgaard algorithms, and the analysis process terminated due to Out of Memory (OoM). This result reflects the efficiency and applicability of the TAN pointer parsing algorithm proposed in this invention.

[0068] According to another aspect of the embodiments of this application, an electronic device is also provided, including a processor and a memory, wherein the processor is configured to implement the steps of the method when executing a computer program stored in the memory.

[0069] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0070] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0071] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0072] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0073] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for extracting incremental data flow paths based on pointer analysis, characterized in that, Includes the following steps: Obtain the initial set of pointer variables associated with the incremental code as the task variable set; Based on the pointer relationship constraint graph, a reverse lookup is performed on the variables in the task variable set to obtain the base variable set and the set of memory objects pointed to by the base variable set; The working set is initialized with the base variable set and the memory object set. The pointer relationship propagation process is executed to propagate the objects in the memory object set to the pointer set of the variables in the task variable set. Pointer variables that point to the memory objects and do not belong to the task variable set are found during the propagation process and are included in the indirect association variable set. Perform explicit dependency variable query on the variables in the indirect association variable set, add the dependency variables obtained by the query to the task variable set, and repeat the reverse query and pointing relationship propagation process until the pointing relationship constraint graph no longer changes. At this time, the final pointing information of all variables in the task variable set and the indirect association variable set is obtained. Based on the obtained final pointing information, an inter-process data dependency subgraph corresponding to the incremental code is constructed, and then the incremental data flow path is extracted.

2. The incremental data flow path extraction method based on pointer analysis as described in claim 1, characterized in that, Methods for obtaining the initial set of pointer variables associated with the incremental code as a task variable set include: Traverse the instruction sequence within the basic block containing the incremental code; Obtain the pointer variables used or defined in the instruction sequence and form the first variable set; Based on the pre-established explicit data dependency mapping relationship between variables, explicit dependency variable lookup is performed on the variables in the first variable set to obtain the set of pointer variables that they directly depend on, which serves as the second variable set. The first set of variables and the second set of variables are merged to obtain the task variable set.

3. The incremental data flow path extraction method based on pointer analysis as described in claim 1, characterized in that, Methods for performing reverse lookups include: Starting from the variables in the task variable set, a recursive query is performed along the incoming edge of the pointing relationship on the pointing relationship constraint graph; During the recursion, if a pointer variable with a basic constraint edge of address allocation class is encountered, it is taken as the recursion endpoint and added to the basic variable set; The recursive query continues until all the base variable sets that can pass pointers to objects to the task variable set are found; The address allocation class basic constraint edge corresponds to the Alloca instruction in LLVM. The pointer variable returned by the Alloca instruction has a basic pointing relationship, and the object it points to is the memory object allocated by the Alloca instruction.

4. The incremental data flow path extraction method based on pointer analysis as described in claim 1, characterized in that, Methods for performing the pointer propagation process include: A working set is initialized with the set of base variables and the set of memory objects they point to; Retrieve pointer variables from the working set, process their copy outgoing edges, load outgoing edges, and store outgoing edges, and propagate objects in the memory object set to the variable set pointed to by the pointer variable; During the propagation process, if it is found that a memory object is propagated to the set of pointer variables that does not belong to the task variable set, then the pointer variable is added to the indirect association variable set. The methods for handling and storing outgoing edges include: For each outgoing edge of the current pointer variable, obtain the target node of that outgoing edge. Propagate the memory objects in the current pointer variable's pointer set to the pointer set of the target node; If the target node does not belong to the task variable set, then add it to the indirect association variable set.

5. The incremental data flow path extraction method based on pointer analysis as described in claim 4, characterized in that, The propagation process is executed iteratively, continuously processing the variables in the working set until the working set is empty and the pointer constraint graph no longer changes, indicating that the propagation process has reached a fixed point.

6. The incremental data flow path extraction method based on pointer analysis as described in claim 1, characterized in that, Methods for performing explicit dependency variable lookups on variables in the aforementioned set of indirectly related variables include: Iterate through each pointer variable in the set of indirectly related variables; For each pointer variable, based on the pre-established explicit variable data dependency mapping, query all other pointer variables that it directly depends on; Add all directly dependent pointer variables found in the query to the task variable set.

7. The incremental data flow path extraction method based on pointer analysis as described in claim 6, characterized in that, The method of repeatedly executing the reverse query and pointer relationship propagation process until the pointer relationship constraint graph no longer changes includes: Whenever a new variable is added to the task variable set, the reverse query is re-executed based on the updated task variable set to obtain a new base variable set and memory object set, and the working set is re-initialized to execute the pointer relation propagation process; This iterative process continues until, in a complete iteration, the task variable set, the indirect association variable set, and the pointing relationship constraint graph no longer change, at which point the final pointing information of all relevant variables is obtained.

8. The incremental data flow path extraction method based on pointer analysis as described in claim 1, characterized in that, Methods for constructing inter-process data dependency subgraphs include: Based on the final pointer information, identify all instruction pairs that have data dependencies on incremental code instructions; Extract the Def-Use edges formed by the instruction pairs, including explicit dependency edges and implicit dependency edges; All Def-Use edges are combined to form the inter-process data dependency subgraph.

9. The incremental data flow path extraction method based on pointer analysis as described in claim 1, characterized in that, The incremental data flow path consists of instructions within the incremental code base block, and all instructions that have direct or indirect data dependencies with these instructions.

10. The incremental data flow path extraction method based on pointer analysis as described in claim 1, characterized in that, If the method detects that a new pointer variable has been added to the indirect association variable set during the propagation of the pointer relationship, it triggers an explicit dependency variable query for that variable and adds the query result to the task variable set, thereby triggering a new round of reverse query and propagation process.

Images